A critical path traversal vulnerability in WWBN AVideo versions 29.0 and prior allows attackers to achieve remote code execution on the underlying server.

The application fails to sanitize input in the locale/save.php endpoint, allowing an authenticated administrator (or an attacker leveraging CSRF) to perform path traversal and write arbitrary PHP code to the filesystem via the flag and code parameters.

The ability to write arbitrary files to the server filesystem leads to full system compromise, including potential data theft, unauthorized modification of application logic, and complete loss of server control. With a CVSS score of 8.7, this vulnerability represents a high-severity risk that could result in significant operational disruption and data breaches.

Immediate Action: As no formal patch version is currently available, administrators should restrict access to the locale/save.php endpoint via web server configuration or disable the affected functionality until an official update is released.

Proactive Monitoring: Monitor server access logs for suspicious requests to locale/save.php and review the filesystem for unauthorized .php files created in unexpected directories.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block directory traversal sequences (such as ../) and unauthorized POST requests to the locale/save.php endpoint.

Public Exploit Available: Unknown

Given the potential for remote code execution, this vulnerability poses a severe threat to the integrity of the hosting environment. Organizations currently running WWBN AVideo must prioritize securing the affected endpoint immediately and monitor for any signs of unauthorized file creation or anomalous administrative activity.